css_parser 3.2.0 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ed961d9c30e5f86976f527c41b777f29bdd558b5e149985e536ba74876fbb6c8
-  data.tar.gz: d12338993a30625469c3cd7ff81932744c877f945a4b361a524744593589a820
+  metadata.gz: b1b890ee0d537d338ae0a218c68424271242859ba814a52c27fcd05ffefe1acd
+  data.tar.gz: 147e41dae4da802d96124fc07b488b122967a44c0ff79bfe623291c1795e0d9b
 SHA512:
-  metadata.gz: c1c189987171a935f347f7fe7f1f528ae2b2ce2d6880eaf6f124ea05c45b4af02685bf765b128188fdc33add0bde3b76b401a99d8268f1534feba6e962a35632
-  data.tar.gz: 5cc19fa3c0047c20331240acd7c3064afdae0d43227de44a7a347eb7239119b09b287225cfaf8840535aa59ce9511f7b467c059b18298424c55231276cb2db3f
+  metadata.gz: 76728b4b816f4b620f28198b6fd5f92f005733bec3afba0df5707d8daf99ab650fd0a0143a6222fc53c5453c32c3a13a76eb4877f3c06f5dc903a559a18d200f
+  data.tar.gz: a5b5a901312932dd9d3c50fa9a6cd4ea549180f57a7e4d85d700d5c3ec58f458927be66c2eb7169165333e153d58061dbdfa98c75c0e6ffb6a81181bc78fdd6f

data/lib/css_parser/parser.rb

@@ -173,6 +173,21 @@ module CssParser
             load_uri!(import_uri, import_options)
           elsif options[:base_dir]
             import_options[:base_dir] = options[:base_dir]
+            # The import path comes from (potentially untrusted) CSS
+            # content, not from the caller. Flag this load so load_file!
+            # keeps it contained within the import root and refuses
+            # absolute paths / `..` traversal that escape it -- otherwise
+            # @import turns into arbitrary local file disclosure. This is
+            # the base_dir sibling of the file://-via-base_uri hole closed
+            # in GHSA-9pmc-p236-855h, which left this arm untouched.
+            #
+            # import_root is the top-level base_dir, threaded through
+            # nested imports so containment is always checked against it.
+            # That still allows legitimate `../` imports that stay inside
+            # the tree (e.g. subdir/import2.css -> ../simple.css) while
+            # rejecting anything that leaves it.
+            import_options[:from_import] = true
+            import_options[:import_root] = options[:import_root] || options[:base_dir]
             load_file!(import_path, import_options)
           end
         end
@@ -558,8 +573,18 @@ module CssParser
     end
 
     # Load a local CSS file.
+    #
+    # +from_import+ (internal) marks a load whose +file_name+ originates
+    # from an @import rule in parsed CSS rather than from the caller. Such
+    # a path is attacker-influenced, so it is contained within the import
+    # root (+import_root+, the top-level +base_dir+): absolute paths and
+    # `..` traversal that escape the root are refused (raising
+    # RemoteFileError when io_exceptions are on, otherwise a silent no-op).
+    # Direct callers (the default, +from_import: false+) are unaffected --
+    # load_file! remains the explicit, trusted local-file API and may load
+    # any readable path.
     def load_file!(file_name, options = {}, deprecated = nil)
-      opts = {base_dir: nil, media_types: :all}
+      opts = {base_dir: nil, media_types: :all, from_import: false, import_root: nil}
 
       if options.is_a? Hash
         opts.merge!(options)
@@ -570,7 +595,29 @@ module CssParser
         opts[:media_types] = deprecated if deprecated
       end
 
+      # Pin the containment root to the first base_dir seen in the chain.
+      # load_file! resets base_dir to each file's own directory as it
+      # recurses, so without this a file loaded from a subdirectory would
+      # shrink the sandbox and reject a legitimate `..` back toward the
+      # caller's original base_dir.
+      opts[:import_root] ||= opts[:base_dir]
+
       file_name = File.expand_path(file_name, opts[:base_dir])
+
+      # Containment check for @import-sourced paths: the resolved file must
+      # stay inside the import root. Rejects both `@import "/etc/passwd"`
+      # (absolute) and `@import "../../secret"` (traversal escaping the
+      # tree) from untrusted CSS, while leaving direct load_file! callers
+      # untouched and still permitting `..` that stays within the root.
+      if opts[:from_import] && (opts[:import_root] || opts[:base_dir])
+        root = File.expand_path((opts[:import_root] || opts[:base_dir]).to_s)
+        unless file_name == root || file_name.start_with?(root + File::SEPARATOR)
+          raise RemoteFileError, file_name if @options[:io_exceptions]
+
+          return
+        end
+      end
+
       return unless File.readable?(file_name)
       return unless circular_reference_check(file_name)
 

data/lib/css_parser/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CssParser
-  VERSION = '3.2.0'.freeze
+  VERSION = '3.3.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: css_parser
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.3.0
 platform: ruby
 authors:
 - Alex Dunae